To set up streaming from Azure Active Directory:
- In Azure Portal, click Azure Active Directory in the side navigation pane.
- Scroll down to Monitoring in the side menu and click Audit logs.
- Click Export Data Settings.
- Click +Add diagnostics setting.
Alternatively, if you already have a logging configuration set up, click Edit Settings next to the diagnostic setting.
- Tick these Logs checkboxes:
- Tick Stream to an event hub.
- Select the event hub namespace and event hub that you created earlier.
If you don’t select an event hub, Azure Portal will create an event hub called insights-logs-audit in the selected namespace.
- Click Save.